{
  "family": "shark",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nShark is a versatile and widely distributed Remote Access Trojan (RAT) family. Originating from underground hacker forums, it is designed to provide threat actors with complete, stealthy administrative control over compromised Windows endpoints. It is frequently utilized in cyber espionage, financial fraud, and as an initial beachhead for ransomware deployment.\n\n<h3>Technical Architecture and Capabilities</h3>\nShark RAT employs a classic client-server architecture. The malware payload (the \"server\") infects the victim's machine, silently establishing a reverse connection back to the attacker's administration panel (the \"client\").\n\nOnce persistence is established—typically via the Windows Registry (`HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`) or hidden scheduled tasks—Shark provides an extensive suite of malicious capabilities:\n<ul>\n<li><strong>System Surveillance:</strong> Real-time keylogging, remote desktop viewing, and the unauthorized activation of integrated webcams and microphones.</li>\n<li><strong>Data Exfiltration:</strong> Covert file managers that allow the attacker to browse the file system, steal sensitive documents, and upload secondary payloads (like credential stealers or crypto-miners).</li>\n<li><strong>Evasion Techniques:</strong> Many variants of Shark incorporate anti-analysis routines, detecting the presence of virtual machines (VMs) or security sandboxes and terminating execution to evade detection by automated analysis tools.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nAn active Shark RAT infection results in a total loss of data confidentiality and system integrity. Because the attacker has interactive, GUI-based access to the endpoint, they can bypass local security controls, pivot to other machines on the network, and exfiltrate highly sensitive corporate intellectual property.\n\n<h3>Detection and Remediation</h3>\n<ul>\n<li><strong>Network Traffic Analysis:</strong> Monitor edge firewalls for anomalous, sustained outbound connections over non-standard ports, which are indicative of the reverse shell connecting back to the Shark C2 infrastructure.</li>\n<li><strong>Behavioral Endpoint Detection:</strong> Utilize EDR platforms tuned to detect processes attempting to access hardware (webcams/microphones) without user authorization, or anomalous processes launching command shells (`cmd.exe`).</li>\n<li><strong>Complete Remediation:</strong> Due to the extensive capabilities of a RAT, removing the initial executable is often insufficient. A complete wipe and re-image of the compromised endpoint is the recommended remediation strategy to guarantee eradication.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "RAT.Shark",
    "Trojan.SharkRAT",
    "Win32/Shark"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1071.001",
    "T1056.001",
    "T1125",
    "T1113"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:06:52Z",
  "type": "Remote Access Trojan",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}